[Krishnadheeraj (DheerajPannala)]

Summary

Agent and service principal IDs are now validated as GUIDs before the CLI passes them to Azure CLI commands, and the command executor refuses cmd.exe-wrapped command lines that contain unquoted shell metacharacters.

Why

On Windows, az is run through cmd.exe /c, so every value placed on that command line has to be a plain token. Some IDs that reach az were read from a365.generated.config.json or from Microsoft Graph responses without checking their format.

Changes

• Config load: agenticUserId and agentBlueprintId must be GUIDs when present (agenticAppId was already checked).
• cleanup / cleanup instance: agenticAppId and agenticUserId are checked again right before az ad app delete / az ad user delete.
• query-entra: the agent identity ID, the service principal object ID, and each grant's resource ID must be GUIDs before they are used in an az call. A non-GUID config value exits with code 1. A non-GUID resource ID skips the display-name lookup.
• Admin consent polling and the az rest consent runner ignore service principal IDs from Graph that are not GUIDs.
• CommandExecutor: when a command is wrapped in cmd.exe /c, the command line is rejected if it contains & | < > ^ outside double quotes, unbalanced quotes, or line breaks. Quoted values such as --url "...&$select=id" are unchanged.

Behavior change

None for configs written by the CLI. A hand-edited config with a non-GUID agent ID now fails to load with a validation error instead of being passed to az.

Testing

• New CommandArgumentGuardTests: rejected command lines, plus the real az command shapes the CLI builds (quoted & in URLs, URL-encoded filters, JMESPath --query, --body @"file") to guard against false positives.
• New config validation test for agenticUserId / agentBlueprintId, and a cleanup instance test confirming a non-GUID agenticUserId exits 1 without calling az.
• AdminConsentHelperTests and the CleanupCommandTests fixture now use GUIDs for IDs that are GUIDs in real Graph responses and configs; assertions are unchanged.
• Full suite: 2436 passed, 12 skipped.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[Copilot]

🟡 Changes recommended

A critical validation bypass lets cmd.exe percent expansion expose command separators in accepted untrusted arguments, enabling command injection.

1 open issue

• Prevent cmd.exe variable expansion from bypassing argument validation · New

What changed in this PR

This PR hardens the Agent365 CLI’s Azure CLI calls by validating agent and service principal IDs and checking command lines before Windows shell execution.

Changes:

• Add GUID validation during configuration loading, cleanup, Entra queries, and consent operations.
• Reject unquoted shell metacharacters, unbalanced quotes, and line breaks in Windows command wrappers.
• Add regression tests, update test fixtures to use GUIDs, and document the change.

File	Description
src/​Tests/​Microsoft.Agents.A365.DevTools.Cli.Tests/​Services/​Agent365ConfigServiceTests.cs	Tests rejection of non-GUID agent IDs.
src/​Tests/​Microsoft.Agents.A365.DevTools.Cli.Tests/​Services/​AdminConsentHelperTests.cs	Uses realistic GUID fixtures without changing assertions.
src/​Tests/​Microsoft.Agents.A365.DevTools.Cli.Tests/​Helpers/​CommandArgumentGuardTests.cs	Tests GUID normalization and command-line checks.
src/​Tests/​Microsoft.Agents.A365.DevTools.Cli.Tests/​Commands/​CleanupCommandTests.cs	Tests invalid user-ID rejection and updates fixtures.
src/​Microsoft.Agents.A365.DevTools.Cli/​Services/​Helpers/​AdminConsentHelper.cs	Validates app and service principal IDs for consent lookups.
src/​Microsoft.Agents.A365.DevTools.Cli/​Services/​ConfigService.cs	Validates agent user and blueprint IDs.
src/​Microsoft.Agents.A365.DevTools.Cli/​Services/​CommandExecutor.cs	Applies checks to both Windows execution paths.
src/​Microsoft.Agents.A365.DevTools.Cli/​Helpers/​CommandArgumentGuard.cs	Adds shared GUID and shell-command guards.
src/​Microsoft.Agents.A365.DevTools.Cli/​Commands/​SetupSubcommands/​AzRestConsentRunner.cs	Rejects invalid resource service principal IDs.
src/​Microsoft.Agents.A365.DevTools.Cli/​Commands/​QueryEntraCommand.cs	Validates IDs before Entra lookup calls.
src/​Microsoft.Agents.A365.DevTools.Cli/​Commands/​CleanupCommand.cs	Validates and normalizes IDs before deletion calls.
CHANGELOG.md	Records ID validation under Unreleased fixes.

_{Review effort: Balanced}

[Rick Brighenti (rbrighenti)]

Reviewed the ID validation and command-executor changes. No blocking findings.

[Copilot]

🟡 Changes recommended

Windows regression tests are skipped in CI and contain ineffective or path-sensitive cases, while the new consent-ID validation lacks targeted test coverage.

4 open issues

• Test invalid ID rejection and valid base64url grant IDs · New
• Add a Windows CI job to run the cmd.exe regression tests · New
• Run the batch file by basename to support temp paths with spaces · New
• Make the payload pass the existing quote-parity check · New

1 resolved since last review

• Prevent cmd.exe variable expansion from bypassing argument validation

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Human assessment is needed because new identifier and consent-type validation paths lack regression coverage, leaving rejection behavior and downstream-call safeguards unverified.

No open issues 🎉

4 resolved since last review

• Make the payload pass the existing quote-parity check
• Run the batch file by basename to support temp paths with spaces
• Add a Windows CI job to run the cmd.exe regression tests
• Test invalid ID rejection and valid base64url grant IDs

_{Review effort: Balanced}